Effective date: 25 October 2026
This Privacy Notice explains how Yehuda Hotel (the “Hotel”, “we”, “us” or “our”) collects, uses, discloses, secures and retains personal information relating to guests, prospective guests, visitors and users of our website, online booking facilities and services. It supplements the Hotel’s general booking and service terms without limiting rights granted by applicable law. References to “you” include the individuals whose personal information is processed in connection with Hotel services.
1. Who we are and how to contact us
Yehuda Hotel is operated by Mashua LeNofesh VeMelona’ut Ltd. (Hebrew: משואה לנופש ומלונאות בע״מ), the company responsible for the Hotel’s relevant personal-information databases and processing activities. Where applicable data protection law uses the term “controller”, this company acts as controller in relation to processing for which it determines the purposes and means.
Address: 1 Haim O. Kulitz Road, Givat Massuah, Jerusalem, Israel. Telephone: +972-2-6322777. Email for privacy enquiries and requests: info@byh.co.il. Website: https://byh.co.il/.
You may contact us with questions, complaints or requests relating to your information. We will address requests in accordance with applicable law. Where a data protection officer or representative is legally required, the relevant contact details will be provided as required.
2. When and from whom we collect information
We collect information when you browse our website; enquire about rooms or facilities; make or change a reservation; check in or check out; stay at or visit the Hotel; pay for services; use restaurants, leisure or other Hotel facilities; contact our call centre; communicate with us; complete a survey; or connect to Hotel Wi-Fi. Information may come directly from you, from someone authorised to book on your behalf, or from travel agents, booking platforms, consumer or membership clubs, survey providers, business partners and service providers in the ordinary course of Hotel operations.
Please provide personal information about another person only when you are authorised to do so and, where appropriate, have informed that person of the disclosure.
3. Categories of personal information
Depending on your interaction with us and what is necessary for the service, we may collect:
- Identity and contact details: name, address, email, telephone number, nationality, date of birth or anniversary where supplied, and identification, passport or driving-licence details when required for a legitimate purpose or by law.
- Booking and stay information: dates, room and service preferences, reservation history, check-in and check-out details, purchases, activities, spa, gym, dining or leisure services used, communications and special requests.
- Payment and commercial information: transaction records, payment method and payment-card information handled through applicable payment arrangements, invoices and, where genuinely required, bank-account details.
- Companion and relationship information: information about accompanying guests, children and family members, relationships to other persons relevant to the booking, vehicle registration, information relevant to bookings or contracts arranged through third parties, and loyalty, professional or other membership information where actually used for Hotel services.
- Special-category or sensitive information: food allergies, accessibility requirements, disability-related information or other health details that you voluntarily share or that are necessary to provide an expressly requested service. We seek to limit such collection to what is needed.
- Security information: CCTV footage from public areas and Hotel facilities, and records relevant to safety, incident handling and property security.
- Digital information: IP address, device and browser information, operating system, referring URL, access times, website pages and interactions, cookie and advertising identifiers, and technical information generated when using Hotel Wi-Fi. Where required for access to Wi-Fi or another service, we may also request contact details or an account identifier, as explained at the point of collection.
- Other information provided in correspondence, complaints, claims, surveys or other interactions. Where actually offered and used, information about media services accessed during a stay or professional/organisational memberships may also be processed to the extent relevant to a requested service.
Not every category is collected from every guest. We do not request unnecessary sensitive details and encourage guests not to send medical or financial information unless it is needed and a suitable channel is available.
4. Whether providing information is mandatory
You are generally not required by law to provide information merely to browse the website. Some information is necessary to make or manage a reservation, identify guests, process payment, provide requested services or comply with specific legal duties; without it, the relevant service may not be available. At the time of collection, where required by Israeli law, we will explain whether providing information is mandatory or voluntary, the purposes of collection, the identity and contact details of the responsible entity, the categories of recipients and the consequences of not providing it, together with applicable access and correction rights.
5. Purposes for which we use personal information
We use information for specific and legitimate purposes, including:
- Identifying guests; receiving, confirming, modifying and managing reservations; providing accommodation, dining and other requested services; coordinating arrivals and departures; and maintaining booking and transaction records.
- Processing payments, issuing invoices, handling refunds, accounting, insurance and related administration.
- Responding to requests, complaints and claims; communicating about reservations, changes to your stay, updates relating to information held about you and material changes to this Notice; improving customer service for you and accompanying family members during current or future stays, where appropriate.
- Protecting guests, employees, visitors, facilities and property; operating CCTV and appropriate security controls; detecting misuse and responding to incidents.
- Meeting legal, regulatory, tax, accounting and reporting obligations and responding to valid requests from competent authorities.
- Establishing, exercising or defending legal claims and resolving disputes.
- Producing statistical or aggregated analyses, maintaining and improving website performance, and assessing service quality, with minimisation or anonymisation where feasible.
- Sending promotional offers, newsletters and event updates, and measuring or personalising advertising, only as permitted by applicable law and subject to any required consent and opt-out rights.
We will not use information for an unrelated new purpose without providing additional notice and, where legally required, obtaining consent or establishing another appropriate legal basis.
6. CCTV and on-site security
CCTV may operate in public areas and Hotel facilities to protect guests, staff, visitors and property and support incident investigation. As stated in the Hotel’s Hebrew policy, CCTV footage is retained for no more than 30 days. Any preservation or disclosure of footage relating to a security incident, complaint or legal proceeding will be managed in accordance with applicable law and the Hotel’s documented procedures, without changing the stated retention limit unless the Hotel updates both language versions of its policy.
7. Guest Wi-Fi and digital services
When you use our website or guest Wi-Fi, we or relevant service providers may process connection and technical data, including IP address, device identifiers, connection times, browser information and service logs. This information is used to provide and secure connectivity, troubleshoot faults, protect systems, comply with applicable obligations and, where appropriate, assess service performance. If a Wi-Fi login requests contact details or access through a social account, the relevant screen should explain what is required and why. Third-party websites and services you access over Wi-Fi are governed by their own terms and privacy notices.
8. Cookies, pixels and similar technologies
Our website uses cookies and may use related technologies, such as tags, pixels, web beacons, JavaScript, device identifiers and measurement links. Some are placed by us and others by third parties. Depending on their configuration, these technologies may collect or reveal browsing behaviour, device and IP information, pages viewed, advertisement interactions and preferences, and may help deliver or measure advertising on our website and on social networks.
We may use the following categories:
- Strictly necessary cookies: support essential website functionality, booking flows, session management, security and transaction integrity.
- Functional cookies: remember preferences such as language, login choices where offered, selected settings and booking-related information. They may support embedded maps or videos where those features are used.
- Analytics and performance cookies: help us understand site traffic, page usage, technical errors and campaign performance.
- Advertising and targeting cookies or pixels: measure responses to advertising and website content, advertising conversions and campaign effectiveness; limit repeated advertising; and, where enabled and lawful, support tailored offers, advertising and remarketing based on interests or approximate location.
- Social-media and embedded-content technologies: may support content sharing or third-party services, such as social networks, maps or video platforms. Third parties that are permitted to place advertising or promotional content on our site may use their own cookies under their own privacy notices, subject to applicable law and the Hotel’s arrangements with them.
Cookies may be session-based (removed at the end of a browser session) or persistent (remaining for a specified period or until deleted). Their duration depends on the technology and its configuration.
The Hotel’s Hebrew privacy notice identifies Google Tag Manager (a tag-management tool rather than a cookie itself), possible use of Google Analytics for usage analysis, Google Ads for advertising measurement, Meta Pixel (Facebook) for campaign measurement and social-media advertising, and SimpleBooking for online reservations. The actual activation and configuration of each tool, including the specific cookies and any transfers to third parties, depend on the technologies in use. These tools may process IP addresses, browser and device details, pages viewed and interactions with the website.
You can manage, block or delete cookies through your browser settings and, where provided on the website, through the cookie-preference interface. You may reject optional cookies where a legally required choice is offered. Clearing browser history does not necessarily remove all cookies; use the browser’s cookie or site-data deletion controls. Blocking essential cookies may prevent certain booking, security or website functions from operating correctly. Where applicable law requires prior consent for non-essential technologies, we will seek it before activating them.
We may use email-related measurement technologies where lawful. Cookies and similar tools may also be used to maintain secure online transactions, assess visitor numbers and navigation, identify technical errors, and improve the speed and efficiency of our services. We do not represent that historical technologies such as Flash cookies are currently deployed.
9. Marketing communications
We may send news, offers, events or promotions using contact information provided to us, where permitted by applicable marketing and privacy laws. Where consent is required, we will request it. You may unsubscribe using the instructions in a marketing message or by contacting info@byh.co.il. Opting out of promotional messages will not prevent necessary booking, payment, service or safety communications. Marketing preferences will be respected in accordance with applicable law.
10. Legal grounds for processing where the GDPR applies
Where a particular processing activity falls within the scope of the GDPR, we rely on one or more legal bases appropriate to that activity:
- Performance of a contract or steps requested before entering into one (Article 6(1)(b)): reservations, accommodation and requested services.
- Compliance with a legal obligation (Article 6(1)(c)): applicable tax, accounting and other statutory requirements.
- Legitimate interests (Article 6(1)(f)): proportionate security, fraud prevention, service administration, complaint handling, website maintenance and legal-claim management, balanced against individual rights and expectations.
- Consent (Article 6(1)(a)): activities requiring a freely given choice, which may include certain optional marketing and non-essential cookies. Consent can be withdrawn for future processing without affecting earlier lawful processing.
- Vital interests or other bases only where the strict conditions for their use are met.
Where health information or other special-category data is processed under the GDPR, an additional condition under Article 9 must also apply, such as explicit consent where appropriate or another valid exception. We will not treat legitimate interests alone as sufficient for special-category data. Actual legal bases must be matched to each processing activity and documented by the Hotel.
11. Sharing personal information
We may share relevant information, limited to what is needed, with reservation and distribution platforms, travel agencies, consumer or membership clubs, tour operators, payment processors, banks, IT hosting and support providers, guest Wi-Fi providers, analytics and advertising providers, insurers, professional advisers, security providers, and competent public authorities where legally required or permitted. Online bookings may involve the external SimpleBooking platform. Information may also be shared where necessary to handle a dispute or legal claim, or for another lawful purpose described in this Notice.
We take steps to ensure that service providers receive only information reasonably required for their tasks and are subject to appropriate confidentiality, contractual, security and access requirements under applicable law. Certain independent third parties, such as booking platforms or payment providers, may act as separate controllers for their own processing and provide their own privacy notices. We do not assume that all providers act solely on our instructions. We do not disclose information to unrelated third parties for their own direct marketing unless permitted by applicable law and any required choice has been provided.
12. International transfers
Information may be processed or accessed in countries outside Israel through reservation platforms, hosting, payment, customer-support or other suppliers. Such transfers are subject to applicable Israeli rules on transferring personal information abroad and appropriate contractual and security arrangements.
Where the GDPR applies to a transfer from the EEA, we will use a valid transfer mechanism where required, such as a European Commission adequacy decision (including the decision concerning Israel where relevant), appropriate standard contractual clauses and supplementary safeguards where necessary, or another lawful mechanism. Transfers to U.S. organisations may rely on the EU–U.S. Data Privacy Framework only where the particular recipient is currently certified and the transfer falls within that framework. The former EU–U.S. Privacy Shield is not relied upon. Information on applicable safeguards may be requested using our contact details.
13. Security of information
We implement technical and organisational measures appropriate to the nature and sensitivity of the information and the risks involved, including measures intended to prevent unauthorised access, use, disclosure, alteration or loss. We also seek suitable safeguards from service providers. No method of electronic transmission or storage can be guaranteed completely secure; however, this does not reduce any legal duty to implement appropriate security measures or respond to incidents as required by law.
14. Retention and deletion
We retain personal information for the period needed to fulfil the purposes for which it was collected, including accommodation and guest services, reservation and transaction records, accounting, tax and reporting duties, insurance, complaints, disputes and the establishment, exercise or defence of legal claims. Retention periods or criteria vary by data category and take account of the amount, nature and sensitivity of information, the risks of unauthorised access or use, the period for which services or legal proceedings may require it, and mandatory retention periods or statutory limits.
At least once a year, we review whether personal information retained in our databases remains necessary for the purposes for which it was collected. Where there is no continuing need, legal duty or other lawful justification to retain it, we will arrange for secure deletion, destruction or anonymisation under applicable law and Hotel procedures. CCTV recordings are retained for no more than 30 days as stated above. More specific retention periods or criteria will be provided where applicable law requires them.
15. Your rights under Israeli law
Under Israel’s Protection of Privacy Law, 5741–1981, and subject to statutory conditions and exceptions, individuals may request access to information about them held in a database. If information is incorrect, incomplete, unclear or outdated, they may request its correction or deletion. Where information is used for direct mailing as defined by law, individuals may request deletion of information used for that purpose; other records may still be retained where permitted or required by law. A refusal may be challenged before the competent Magistrates’ Court as provided by law. Please send requests to info@byh.co.il, identifying yourself and providing reasonable contact details so that we can process and verify your request. We will respond in accordance with the applicable statutory requirements.
16. Additional rights where the GDPR applies
Where the GDPR applies to the processing of your information, you may have rights, subject to legal conditions and exceptions, to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. You have the right to object at any time to processing for direct marketing, including related profiling. Where processing is based on consent, you may withdraw consent at any time for future processing. You may also have rights relating to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, if such processing takes place.
You may lodge a complaint with a competent EU/EEA supervisory authority where the GDPR gives you that right. Requests can be sent to info@byh.co.il. We will apply the response periods, identity-verification safeguards and available exceptions required by the GDPR where it applies. We do not claim that these rights automatically apply to every guest or every processing activity.
17. Information for California and other U.S. residents
U.S. privacy laws differ by state and do not automatically apply to a hotel merely because a guest resides in the United States. Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), applies to the Hotel and the relevant information, eligible California residents may have rights to know or access information, request deletion or correction, opt out of sale or sharing of personal information, limit certain uses of sensitive personal information, and be free from discrimination for exercising applicable rights, subject to statutory conditions and exceptions. Please contact info@byh.co.il to enquire about applicable rights. If the CCPA/CPRA applies, the Hotel must also provide any required specific notices, methods for exercising rights and disclosures concerning categories of information, retention, sales/sharing and sensitive information; this paragraph is not a substitute for those operational requirements.
Separately, if California Civil Code section 1798.83 (“Shine the Light”) applies and the relevant disclosure conditions are met, qualifying California customers may request information about certain disclosures of personal information to third parties for those parties’ direct-marketing purposes during the preceding calendar year. Requests may be directed to info@byh.co.il. This does not mean the Hotel necessarily makes such disclosures.
Residents of other U.S. states may have additional rights if a particular state law applies to the Hotel. We will consider requests in accordance with the law applicable to the specific processing activity.
18. Children and accompanying guests
We may process limited information about children and accompanying guests to arrange accommodation, meet safety needs and provide requested family services. Where consent from a parent or guardian is legally required, we will seek it through an appropriate process. We do not intend to use children’s information for unrelated advertising or profiling without an appropriate lawful basis and required safeguards. Parents or guardians may contact us about information concerning their children, subject to applicable verification and legal rules.
19. Third-party websites and booking services
Our website may contain links to independent third-party websites, social networks and booking or payment services. Those providers may collect and use information under their own privacy notices. Please review their notices before submitting information. Our description of third-party services does not exclude any responsibility that applicable law imposes on us for our own choices, disclosures or processing arrangements.
20. Changes to this Notice
We may amend this Notice from time to time. Material changes concerning the personal information we hold will be reflected in the version published on our website, with an updated effective date. Continued website use or a stay at the Hotel does not by itself replace any consent or notice separately required by applicable law.
For privacy questions or requests: info@byh.co.il | +972-2-6322777 | 1 Haim O. Kulitz Road, Givat Massuah, Jerusalem, Israel.